From: John Hasler on
Thanks writes:
> Removing the NSA code...

Andrew Halliwell writes:
> He probably means SELinux stuff... I can't say I've ever used any of
> that myself, so it is pretty superfluous for me. His reasons might be
> paranoia though.

plenty900 writes:
> Paranoia is fear without facts. Fear with the facts is called being sane
> and sensible.

He has the facts: the source code.

1) He evidently believes that he is so important that the NSA is interested
in him.

2) He believes that the NSA programmers are so clever that they can hide
exploits in source code so well that the thousands of hackers out there
who would make their careers as security experts (actually, some have
already made those careers in other ways) can't find it.

3) He believes that the NSA would be so generous as to put their exploits
only in the patches labeled as coming from the NSA.

Ok...

(Or maybe he is so clever that he can find NSA exploits no one else can,
and so selfish he keeps them secret (perhaps to use himself?))

--
John Hasler
john(a)dhh.gt.org
Dancing Horse Hill
Elmwood, WI USA
From: Nico Kadel-Garcia on
John Hasler wrote:
> Thanks writes:
>> Removing the NSA code...
>
> Andrew Halliwell writes:
>> He probably means SELinux stuff... I can't say I've ever used any of
>> that myself, so it is pretty superfluous for me. His reasons might be
>> paranoia though.
>
> plenty900 writes:
>> Paranoia is fear without facts. Fear with the facts is called being sane
>> and sensible.
>
> He has the facts: the source code.
>
> 1) He evidently believes that he is so important that the NSA is interested

Wait. No. This is not what he stated. And the NSA has a long history of
casually monitoring civilian traffic, in direct violation of its charter, the
law, and the constitution. (Look at the warrant-free taps they put on the
backbones of AT&T, mentioned all over various media including this article:
http://www.wired.com/science/discoveries/news/2006/05/70908. They can, and do,
monitor at any time and in any way they deem suitable.

Then look at their role in the creation of the Clipper Chip, an encryption
technology designed to rest the decryption keys in federal hands, and its
abandonment when it was discovered the chips could be used with unregistered keys.

> 2) He believes that the NSA programmers are so clever that they can hide
> exploits in source code so well that the thousands of hackers out there
> who would make their careers as security experts (actually, some have
> already made those careers in other ways) can't find it.

That's a different story. I can easily believe that they, as its authors, are
aware of a few subtleties not widely published. A backdoor doesn't have to be
robust, merely buried in many thousands of line of complex code. And it
doesn't have to be permanent.

This does not mean SELinux is useless, but that it should be viewed with a
very cautious eye, considering its source.

> 3) He believes that the NSA would be so generous as to put their exploits
> only in the patches labeled as coming from the NSA.

Again, no. He didn't say this. Please don't extrapolate his thoughts into
complete nonsense: while SELinux has been widely used and reasonably reviewed,
it deserves careful and justified distrust of its source.

> Ok...
>
> (Or maybe he is so clever that he can find NSA exploits no one else can,
> and so selfish he keeps them secret (perhaps to use himself?))

Now, you're just trolling.